前面一篇文章说到
实现一个配置类继承WebSecurityConfigurerAdapter，并且重写configure(HttpSecurity http)方法。同样可以取消掉Security登录验证。
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().antMatchers("/**").permitAll();
}
/**
* 配置一个userDetailsService Bean
* 不再生成默认security.user用户
*/
@Bean
@Override
protected UserDetailsService userDetailsService() {
return super.userDetailsService();
}
}
这种方式取消了Security的验证。关于登录的一些操作就是在这做，例如用户防重复登录等。上面的方法是取消了Security的登录验证，在这可以像配置文件中配置用户名和密码一样，把用户名和密写在这。
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
// @Override
// protected void configure(HttpSecurity http) throws Exception {
// http.authorizeRequests().antMatchers("/**").permitAll();
// }
/**
* 将配置中的用户名和密码写在这里。
* 这里可以对用户密码进行加密
* 这个configure和上面的configure只存在一个更加合理，因为上面的configure是取消验证，这个是给验证加规则
* @param auth
* @throws Exception
*/
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication()
.passwordEncoder(new BCryptPasswordEncoder())
.withUser("admin")
.password(new BCryptPasswordEncoder().encode("admin"))
.roles("ADMIN");
}
/**
* 配置一个userDerailsService Bean
* 不再生成默认security.user用户
*/
protected UserDetailsService userDetailsService(){
return super.userDetailsService();
}
}
这样书写就是将用户名和密码写在了后台代码中，实现了和配置文件中一样的功能。但是正常情况下登录不会是这样简单.
我们可以这样做，在WebSecurityConfigureAdapter实现类中实现下面代码。
将加密类型抽离出来，实现UserDetailsService接口，将两者注入到AuthenticationManagerBuilder中：
import com.one.smile.service.impl.MyUserDetailsService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
//在MyUserDetailsService中实现用户名和密码的操作
@Autowired
private MyUserDetailsService userDetailsService;
@Bean
public BCryptPasswordEncoder passwordEncoder(){
return new BCryptPasswordEncoder();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService)
.passwordEncoder(passwordEncoder());
}
}
Service层类MyUserDeailsService
UserDetaisService接口实现类
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Service;
import java.util.ArrayList;
import java.util.Collection;
@Service
public class MyUserDetailsService implements UserDetailsService {
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
Collection<GrantedAuthority> authorities = new ArrayList<>();
authorities.add(new SimpleGrantedAuthority("ADMIN"));
return new User("root", new BCryptPasswordEncoder().encode("root"), authorities);
}
}
这里的 User 对象是框架提供的一个用户对象，注意包名是：org.springframework.security.core.userdetails.User，里面的属性中最核心的就是password，username和authorities。
这时候去访问项目，要求输入的用户名和密码就是你抽离出去的UserDetailsService接口的实现类中定义的用户名和密码。
